qtnfmac: fix potential Spectre vulnerabilities (946d077a) · Commits · 戴 / test

drivers/net/wireless/quantenna/qtnfmac/core.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -4,6 +4,7 @@
		#include <linux/kernel.h>
		#include <linux/module.h>
		#include <linux/if_ether.h>
		#include <linux/nospec.h>

		#include "core.h"
		#include "bus.h"
		@@ -41,11 +42,12 @@ struct qtnf_wmac qtnf_core_get_mac(const struct qtnf_bus bus, u8 macid)
		{
		struct qtnf_wmac *mac = NULL;

		if (unlikely(macid >= QTNF_MAX_MAC)) {
		if (macid >= QTNF_MAX_MAC) {
		pr_err("invalid MAC index %u\n", macid);
		return NULL;
		}

		macid = array_index_nospec(macid, QTNF_MAX_MAC);
		mac = bus->mac[macid];

		if (unlikely(!mac)) {

+6 −3

Original line number	Diff line number	Diff line
		@@ -4,6 +4,7 @@
		#include <linux/kernel.h>
		#include <linux/module.h>
		#include <linux/slab.h>
		#include <linux/nospec.h>

		#include "cfg80211.h"
		#include "core.h"
		@@ -632,18 +633,20 @@ static int qtnf_event_parse(struct qtnf_wmac *mac,
		int ret = -1;
		u16 event_id;
		u16 event_len;
		u8 vifid;

		event = (const struct qlink_event *)event_skb->data;
		event_id = le16_to_cpu(event->event_id);
		event_len = le16_to_cpu(event->mhdr.len);

		if (likely(event->vifid < QTNF_MAX_INTF)) {
		vif = &mac->iflist[event->vifid];
		} else {
		if (event->vifid >= QTNF_MAX_INTF) {
		pr_err("invalid vif(%u)\n", event->vifid);
		return -EINVAL;
		}

		vifid = array_index_nospec(event->vifid, QTNF_MAX_INTF);
		vif = &mac->iflist[vifid];

		switch (event_id) {
		case QLINK_EVENT_STA_ASSOCIATED:
		ret = qtnf_event_handle_sta_assoc(mac, vif, (const void *)event,

+1 −1

Original line number	Diff line number	Diff line
		@@ -593,7 +593,7 @@ static int qtnf_pcie_skb_send(struct qtnf_bus bus, struct sk_buff skb)
		priv->tx_bd_w_index = i;

		tx_done:
		if (ret && skb) {
		if (ret) {
		pr_err_ratelimited("drop skb\n");
		if (skb->dev)
		skb->dev->stats.tx_dropped++;